CVE-2015-7872: linux linux_kernel Improper Input Validation

Modified

AliasesUBUNTU-CVE-2015-7872USN-2824-1DEBIAN-CVE-2015-7872

Published 16-11-2015Last modified 06-08-2024

Vulnerability summary

CVE-2015-7872 is a low (CVSS 2.1) Improper Input Validation vulnerability in linux linux_kernel. EPSS estimates a 0.51% chance of exploitation in the next 30 days, higher than 43.4% of scored vulnerabilities.

Priority

Routine

Not severe (CVSS 2.1, local access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?

CVSS score

2.1/10

010

Low · v2.0 (NVD)

EPSS score

0.51%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Timeline

16-11-2015
PublishedVulnerability first disclosed.
06-08-2024
Last modifiedVulnerability information updated.

Description

The key_gc_unused_keys function in security/keys/gc.c in the Linux kernel through 4.2.6 allows local users to cause a denial of service (OOPS) via crafted keyctl commands.

CVSS metrics

1 score · 1 source · 1 version

v2.02.1

EPSS trend

Probability

0.51%

Chance of exploitation in the next 30 days

Percentile

43%

Versus all other CVEs

30-day change

No change 0.00 pp

From 0.51% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-20Improper Input ValidationThe product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Affected systems

Version check

Known conditions: local access, no authentication (CVSS vector). Other conditions: not stated in public data.

Ubuntu21 products

linux< 3.13.0-70.113
linux-azureAll versions (No fix recorded)
linux-azure-6.11All versions (No fix recorded)
linux-azure-fdeAll versions (No fix recorded)
linux-azure-fde-5.15All versions (No fix recorded)

Show all 21

Debian1 product

linux< 4.2.5-1

Linux1 product

linux_kernel≤ 4.2.6

3 vendors · 23 products

References

60 links

lists.opensuse.org/opensuse-security-announce/2015-12/msg00018.htmlVendor AdvisoryX Refsource SUSE
rhn.redhat.com/errata/RHSA-2015-2636.htmlVendor AdvisoryX Refsource REDHAT
rhn.redhat.com/errata/RHSA-2016-0212.htmlVendor AdvisoryX Refsource REDHAT
git.kernel.org/cgit/…X Refsource CONFIRMVendor Advisory
lists.opensuse.org/opensuse-security-announce/2016-02/msg00009.htmlVendor AdvisoryX Refsource SUSE
lists.opensuse.org/opensuse-security-announce/2015-12/msg00031.htmlVendor AdvisoryX Refsource SUSE
bugzilla.redhat.com/show_bug.cgi?id=1272172X Refsource CONFIRM
lists.opensuse.org/opensuse-security-announce/2016-02/msg00034.htmlVendor AdvisoryX Refsource SUSE
www.ubuntu.com/usn/USN-2826-1Vendor AdvisoryX Refsource UBUNTU
source.android.com/security/bulletin/2016-12-01.htmlX Refsource CONFIRM

Show all 60 references

bugzilla.redhat.com/show_bug.cgi?id=1272371X Refsource CONFIRMREPORT
www.ubuntu.com/usn/USN-2840-1Vendor AdvisoryX Refsource UBUNTU
h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05068676X Refsource CONFIRM
marc.info?l=bugtraq&m=145975164525836&w=2Vendor AdvisoryX Refsource HP
www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.htmlX Refsource CONFIRM
www.ubuntu.com/usn/USN-2843-1Vendor AdvisoryX Refsource UBUNTU
lists.opensuse.org/opensuse-security-announce/2015-12/msg00005.htmlVendor AdvisoryX Refsource SUSE
www.openwall.com/lists/oss-security/2015/10/20/6Mailing ListX Refsource MLIST
lists.opensuse.org/opensuse-security-announce/2016-02/msg00017.htmlVendor AdvisoryX Refsource SUSE
www.ubuntu.com/usn/USN-2829-2Vendor AdvisoryX Refsource UBUNTU
lists.opensuse.org/opensuse-security-announce/2016-02/msg00013.htmlVendor AdvisoryX Refsource SUSE
www.ubuntu.com/usn/USN-2843-2Vendor AdvisoryX Refsource UBUNTU
lists.opensuse.org/opensuse-security-announce/2016-02/msg00007.htmlVendor AdvisoryX Refsource SUSE
lists.opensuse.org/opensuse-security-announce/2015-12/msg00026.htmlVendor AdvisoryX Refsource SUSE
lists.opensuse.org/opensuse-security-announce/2015-11/msg00035.htmlVendor AdvisoryX Refsource SUSE
www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.htmlX Refsource CONFIRM
rhn.redhat.com/errata/RHSA-2016-0185.htmlVendor AdvisoryX Refsource REDHAT
git.kernel.org/cgit/…X Refsource CONFIRM
www.ubuntu.com/usn/USN-2840-2Vendor AdvisoryX Refsource UBUNTU
github.com/torvalds/linux/commit/f05819df10d7b09f6d1eb6f8534a8f68e5a4fe61X Refsource CONFIRM
lists.opensuse.org/opensuse-security-announce/2016-02/msg00019.htmlVendor AdvisoryX Refsource SUSE
www.ubuntu.com/usn/USN-2829-1Vendor AdvisoryX Refsource UBUNTU
www.ubuntu.com/usn/USN-2823-1Vendor AdvisoryX Refsource UBUNTU
lists.opensuse.org/opensuse-security-announce/2016-02/msg00021.htmlVendor AdvisoryX Refsource SUSE
rhn.redhat.com/errata/RHSA-2016-0224.htmlVendor AdvisoryX Refsource REDHAT
lists.opensuse.org/opensuse-security-announce/2016-08/msg00038.htmlVendor AdvisoryX Refsource SUSE
www.securitytracker.com/id/1034472VDB EntryX Refsource SECTRACK
lists.opensuse.org/opensuse-security-announce/2016-02/msg00020.htmlVendor AdvisoryX Refsource SUSE
www.ubuntu.com/usn/USN-2843-3Vendor AdvisoryX Refsource UBUNTU
github.com/torvalds/linux/commit/ce1fad2740c648a4340f6f6c391a8a83769d2e8cX Refsource CONFIRMVendor Advisory
www.debian.org/security/2015/dsa-3396Vendor AdvisoryX Refsource DEBIAN
lists.opensuse.org/opensuse-security-announce/2016-04/msg00015.htmlVendor AdvisoryX Refsource SUSE
lists.opensuse.org/opensuse-security-announce/2016-02/msg00022.htmlVendor AdvisoryX Refsource SUSE
www.ubuntu.com/usn/USN-2824-1Vendor AdvisoryX Refsource UBUNTU
www.securityfocus.com/bid/77544VDB EntryX Refsource BID
lists.opensuse.org/opensuse-security-announce/2016-02/msg00018.htmlVendor AdvisoryX Refsource SUSE
ubuntu.com/security/CVE-2015-7872REPORT
www.openwall.com/lists/oss-security/2015/10/20/5REPORT
ubuntu.com/security/notices/USN-2823-1Advisory
ubuntu.com/security/notices/USN-2824-1Advisory
ubuntu.com/security/notices/USN-2826-1Advisory
ubuntu.com/security/notices/USN-2829-1Advisory
ubuntu.com/security/notices/USN-2829-2Advisory
ubuntu.com/security/notices/USN-2843-1Advisory
ubuntu.com/security/notices/USN-2840-1Advisory
ubuntu.com/security/notices/USN-2843-2Advisory
ubuntu.com/security/notices/USN-2843-3Advisory
ubuntu.com/security/notices/USN-2840-2Advisory
www.cve.org/CVERecord?id=CVE-2015-7872REPORT
security-tracker.debian.org/tracker/CVE-2015-7872Advisory